Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:118305
Return-Path: <tim@bastelstu.be>
Delivered-To: mailing list internals@lists.php.net
Received: (qmail 55206 invoked from network); 27 Jul 2022 14:49:21 -0000
Received: from unknown (HELO php-smtp4.php.net) (45.112.84.5)
  by pb1.pair.com with SMTP; 27 Jul 2022 14:49:21 -0000
Received: from php-smtp4.php.net (localhost [127.0.0.1])
	by php-smtp4.php.net (Postfix) with ESMTP id 1072D180380
	for <internals@lists.php.net>; Wed, 27 Jul 2022 09:47:40 -0700 (PDT)
X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on php-smtp4.php.net
X-Spam-Level: 
X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIM_SIGNED,
	DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,SPF_HELO_NONE,SPF_PASS,
	T_SCC_BODY_TEXT_LINE autolearn=no autolearn_force=no version=3.4.2
X-Spam-ASN: AS24940 176.9.0.0/16
X-Spam-Virus: No
X-Envelope-From: <tim@bastelstu.be>
Received: from chrono.xqk7.com (chrono.xqk7.com [176.9.45.72])
	(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
	(No client certificate requested)
	by php-smtp4.php.net (Postfix) with ESMTPS
	for <internals@lists.php.net>; Wed, 27 Jul 2022 09:47:39 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=bastelstu.be;
	s=mail20171119; t=1658940457;
	bh=OM0jyYG5SmzzaFjleKXLI8EGesnIyIKZ5x1wBj6ZzNg=;
	h=Date:Subject:From:To:References:In-Reply-To:From;
	b=OiZgL66G/3emg8scwD7IBFKYk1TbZpqZau4wmuQ9lwiRw/rCPeMC59B4zBWzP3Rcj
	 5mM7NeorL2ANFOimAy6kMMTyrp7GFIJXBQOIYUfrwgu5JYeQLhGKhPXYe7bbTW1+A+
	 CNp8xAr50hsM5kqFk8U+uhz/kj+jnpvWuO4zKAmJvjaom7vofxyES7Vbw7dB880D4m
	 rFG8/mzfLq1obu5RsKe5uskqadO4X17PqbJMCDeYYLpZxyiHckMvDEcPH/PWLra8A1
	 sbcFI2ywpx10B551NDmoSa5vOzpF8pfHFVRmflPyme+vLEXdEmH/znuLH9iwfmrKGh
	 qbYk8rlkaeGzQ==
Message-ID: <68573dc9-90b7-37c2-eadc-20de2aa03fd8@bastelstu.be>
Date: Wed, 27 Jul 2022 18:47:37 +0200
MIME-Version: 1.0
Content-Language: en-US
To: Go Kudo <zeriyoshi@gmail.com>, PHP internals <internals@lists.php.net>
References: <CABTDVhC4J8WuKj4SdVK6hbZX2k7qrPDVCQ2g1Yb_4k4Hf5MEQQ@mail.gmail.com>
 <aa395f78-aebe-d52c-a419-aa0effeb64df@bastelstu.be>
In-Reply-To: <aa395f78-aebe-d52c-a419-aa0effeb64df@bastelstu.be>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit
Subject: Re: [PHP-DEV] What do you think CSPRNG in PHP
From: tim@bastelstu.be (=?UTF-8?Q?Tim_D=c3=bcsterhus?=)

Hi

On 7/16/22 23:33, Tim Düsterhus wrote:
> Personally I likely wouldn't have merged the PR in question for the same
> reasons. But at least in that case glibc is at fault :-)

For those following along:

It turns out the glibc "userland" implementation of arc4random() was 
questionable and was simplified to be a relatively simple wrapper around 
getrandom():

https://github.com/php/php-src/pull/8984#issuecomment-1195986646

and

https://sourceware.org/pipermail/libc-alpha/2022-July/140939.html

Best regards
Tim Düsterhus